REVscene - Vancouver Automotive Forum

Mills64 · 03-29-2009, 04:45 PM

I've been having some troubles with the internet for a few weeks now and i know nothing about this stuff.
I have an HP PC with Windows XP with DSL and normally use internet explorer. One day Explorer stopped working. Every website i go to it says "Internet Explorer cannot display the webpage." So i did the usual and shut off the computer, unplugged everything and plugged it back in but got the same thing.

For whatever reason Netscape 7.2 works fine but IE will not work. I downloaded Firefox but that didn't work either. So i'm stuck using netscape only. I tried upgrading to IE8 which did nothing. I don't mind using Netscape, but since Explorer stopped working, Limewire will not connect either. I attached a couple pics of the router(?). i do have a wireless setup as well for my laptop. I havent changed anything since i first hooked everything up.

Black Wire on the far left goes into a telephone outlet in the wall.
Green wire goes into another telephone outlet in the wall. I'm guessing this is for our wireless upstairs.
Grey wire goes to the back of the comp
I don't if any of that is relevant but here are pics anyway.

In the 2nd pic there #2 is lit up with a green light, it did not show up when i took the pic.

Any help or suggestions would be greatly appreciated.

Presto · 03-29-2009, 04:57 PM

If Netscape works, then I don't think the problem is the connection. Take a look at a few more things on the computer. Does anything else, internet-related, work? Maybe Winsock is messed up. You can try LSP-Fix.

Mills64 · 03-29-2009, 05:11 PM

LSP fix did not work. I'm not even sure what Winsock is. What else would be internet related?

DragonChi · 03-29-2009, 05:21 PM

is this problem only on your HP pc or also on your laptop?

Mills64 · 03-29-2009, 05:22 PM

I tried IE8 again and it came up with the same error message. I clicked on "Diagnose Connection Problems." It ran a diagnostic for HTTP, HTTPS and FTP ports. It says: "Windows did not detect any problems with your internet connection over HTTP and HTTPS, but was not able to make a successful connection over FTP. The most likely cause of this problem is that a firewall client running on your machine is blocking the necessary FTP ports."

I have tried to shut off the windows firewall and fire up IE8 but that doesn't work.

Laptop is fine, i haven't have any problems with it.

Harvey Specter · 03-29-2009, 06:52 PM

Have you checked your LAN settings in IE?

Mills64 · 03-29-2009, 07:43 PM

no sir, how do i do that?

Harvey Specter · 03-29-2009, 07:45 PM

Tools -> internet options -> connections

Mills64 · 03-29-2009, 07:57 PM

I'm sure what i'm really checking here. I clicked on LAN settings and it is set to Automatically Detect Settings.

Razor Ramon HG · 03-29-2009, 08:13 PM

Looks fine then, he just wanted you to check if you were set up to use a proxy.

Mills64 · 03-29-2009, 08:14 PM

Now i'm trying to reconnect to the internet and it says i have no dial tone, yet Netscape still works fine. This shit is frusterating.

johny · 03-29-2009, 10:17 PM

probably virus / spyware messing it up.

download and run "malwarebytes"

InvisibleSoul · 03-30-2009, 12:31 AM

Quote:

Originally Posted by Mills64

I'm sure what i'm really checking here. I clicked on LAN settings and it is set to Automatically Detect Settings.

Try unchecking "Automatically Detect Settings".

Harvey Specter · 03-30-2009, 12:43 AM

Quote:

Originally Posted by johny

probably virus / spyware messing it up.

download and run "malwarebytes"

Hopefully he's done this but good suggestion.

Also download and run hijackthis and post the log in here.
http://www.spychecker.com/program/hijackthis.html

Also if you can, take a snap of your registry by going to run -> type in "regdit" and find the following;
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Internet Settings

Mills64 · 03-31-2009, 07:23 AM

Thanks for all the suggestions guys. I downloaded and ran Malwarebytes already. I'm also not sure how to pull up my registry. I clicked on Start > Run > "Regdit" and it says windows cannot find it. I downloaded hijackthis and posted the log below.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.ca/"); (C

Documents and Settings\OWNER\Application Data\Mozilla\Profiles\default\jttwwa56.slt\prefs.j s)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csea rchplugins%5CSBWeb_01.src"); (C

Documents and Settings\OWNER\Application Data\Mozilla\Profiles\default\jttwwa56.slt\prefs.j s)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C

Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C

Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C

Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C

Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C

Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C

Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C

Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C

Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\sw g.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C

Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: (no name) - {5345A7A9-805A-4923-B505-86B2FEBA3FE0} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C

Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C

Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C

Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C

Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C

Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C

Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Qqamu] rundll32.exe "C

WINDOWS\Ojilacehezusuq.dll",e
O4 - HKLM\..\Run: [Ccapizajovanile] rundll32.exe "C

WINDOWS\aziviyiyimevoco.dll",e
O4 - HKLM\..\Run: [Bar] C

WINDOWS\TEMP\888HF8u5.exe
O4 - HKCU\..\Run: [ctfmon.exe] C

WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [POSTRBT] C

Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C

WINDOWS\system32\Macromed\Flash\FlashUtil9e.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [POSTRBT] C

Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe /REMEDIATE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C

Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C

Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C

Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C

Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C

Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C

Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C

PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C

PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C

WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C

WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C

Program Files\PokerStars.NET\PokerStarsUpdate.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C

Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C

Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1100138022359
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C

PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Reload Browse - {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} - (no file)
O23 - Service: Symantec Core LC - Unknown owner - C

Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/Owner/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

syee · 03-31-2009, 07:35 AM

O4 - HKLM\..\Run: [Qqamu] rundll32.exe "CWINDOWS\Ojilacehezusuq.dll",e
O4 - HKLM\..\Run: [Ccapizajovanile] rundll32.exe "CWINDOWS\aziviyiyimevoco.dll",e
O4 - HKLM\..\Run: [Bar] CWINDOWS\TEMP\888HF8u5.exe

Those lines look suspicious. The names look suspiciously like trojans/malware. Could be a browser hijack, although Malwarebytes usually can detect those.

Try back up HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry first and then delete those three entries and reboot.

See if IE works after that.

Also, the spelling of regedit is wrong. You left out the e which is why it didn't work.

Harvey Specter · 03-31-2009, 01:38 PM

Quote:

Originally Posted by syee

O4 - HKLM\..\Run: [Qqamu] rundll32.exe "CWINDOWS\Ojilacehezusuq.dll",e
O4 - HKLM\..\Run: [Ccapizajovanile] rundll32.exe "CWINDOWS\aziviyiyimevoco.dll",e
O4 - HKLM\..\Run: [Bar] CWINDOWS\TEMP\888HF8u5.exe

Those lines look suspicious. The names look suspiciously like trojans/malware. Could be a browser hijack, although Malwarebytes usually can detect those.

Try back up HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry first and then delete those three entries and reboot.

See if IE works after that.

Also, the spelling of regedit is wrong. You left out the e which is why it didn't work.

I would rename those 3 files and restart your computer and see if it fixes the problem. If you can't rename them, restart your computer and go into "safe mode".

Mills64 · 03-31-2009, 07:33 PM

This line:
O4 - HKLM\..\Run: [Ccapizajovanile] rundll32.exe "C

WINDOWS\aziviyiyimevoco.dll"
Would not delete. I clicked on "Fix Checked" and it stays there, where as the other two were removed. I'm guessing it was fixed? I couldn't figure out how to rename them either.

"Try back up HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry first and then delete those three entries and reboot. "

Not too sure what you mean by that.

How do i restart in safe mode?

I found the "regedit" thing but how do i take a snap shot of the screen?

I feel computer stupid.

InvisibleSoul · 04-01-2009, 01:03 AM

When you boot your computer up, press F8 to get the option to boot in Safe Mode.

syee · 04-01-2009, 01:07 AM

Quote:

Originally Posted by Mills64

This line:
O4 - HKLM\..\Run: [Ccapizajovanile] rundll32.exe "C

WINDOWS\aziviyiyimevoco.dll"
Would not delete. I clicked on "Fix Checked" and it stays there, where as the other two were removed. I'm guessing it was fixed? I couldn't figure out how to rename them either.

"Try back up HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry first and then delete those three entries and reboot. "

Not too sure what you mean by that.

How do i restart in safe mode?

I found the "regedit" thing but how do i take a snap shot of the screen?

I feel computer stupid.

If you already deleted the other two, then backing up won't be any use.

I only suggested a backup in case it broke something after we deleted and rebooted.

Do what InvisibleSoul mentioned - boot up in Safe Mode, go back into regedit, and try delete the remaining entry.

To get to regedit, click on Start->Run and type Regedit. Then navigate the keys like you would Windows Explorer.

Mills64 · 04-02-2009, 07:28 PM

Quote:

Originally Posted by syee

If you already deleted the other two, then backing up won't be any use.

I only suggested a backup in case it broke something after we deleted and rebooted.

Do what InvisibleSoul mentioned - boot up in Safe Mode, go back into regedit, and try delete the remaining entry.

To get to regedit, click on Start->Run and type Regedit. Then navigate the keys like you would Windows Explorer.

What am i deleting in the registry?
All i deleted before was the 2/3 suspicious things in the list i got from using "Hijackthis"

Am i confused again...i will try restarting in safe mode

Mills64 · 04-02-2009, 07:54 PM

IE works in Safe mode. So what does that mean?

I also deleted that last suspicious line while in safe mode.

syee · 04-02-2009, 07:58 PM

Quote:

Originally Posted by Mills64

What am i deleting in the registry?
All i deleted before was the 2/3 suspicious things in the list i got from using "Hijackthis"

Am i confused again...i will try restarting in safe mode

OK, here's a step by step:

1. Go to Start->Run. In the Run box, type regedit
2. The Registry Editor will open and kind of looks like Windows Explorer. You want to be going into HKEY_LOCAL_MACHINE.
3. Expand out HKEY_LOCAL_MACHINE -> SOFTWARE -> Microsoft -> Windows ->CurrentVersion->Run
4. When you have Run selected, you'll see a bunch of lines on the right side.
5. Look for the lines where under Data it says the following:
rundll32.exe "CWINDOWS\Ojilacehezusuq.dll",e
rundll32.exe "CWINDOWS\aziviyiyimevoco.dll",e
CWINDOWS\TEMP\888HF8u5.exe
6. Highlight each of those lines, then hit delete. It should ask you for confirmation, just click YES and repeat for the rest of them.
7. Reboot and check to see if IE works now or not.

Razor Ramon HG · 04-02-2009, 10:45 PM

I'm too lazy, but someone here could just write a script that automatically deletes those registry entries since the OP has no fucking idea what he's doing, and the registry is serious business.

Mills64 · 04-05-2009, 06:36 PM

Quote:

Originally Posted by syee

OK, here's a step by step:

1. Go to Start->Run. In the Run box, type regedit
2. The Registry Editor will open and kind of looks like Windows Explorer. You want to be going into HKEY_LOCAL_MACHINE.
3. Expand out HKEY_LOCAL_MACHINE -> SOFTWARE -> Microsoft -> Windows ->CurrentVersion->Run
4. When you have Run selected, you'll see a bunch of lines on the right side.
5. Look for the lines where under Data it says the following:
rundll32.exe "CWINDOWS\Ojilacehezusuq.dll",e
rundll32.exe "CWINDOWS\aziviyiyimevoco.dll",e
CWINDOWS\TEMP\888HF8u5.exe
6. Highlight each of those lines, then hit delete. It should ask you for confirmation, just click YES and repeat for the rest of them.
7. Reboot and check to see if IE works now or not.

I did that, and there was only 2 lines. 1 was a rundll32.exe one and the other was "default" which i did not delete. IE still doesnt work. I dont have a fucking clue.